In an application program, a network service, or the like, attempts have been made to find a delay point or an abnormal point (see, for example, the following Patent Documents 1 and 2).
Generally, in order to find the delay point or the abnormal point, it is necessary to collect a log before and after the point and continue to monitor a state of the point. For example, in the case of a processing sequence of start-A-B-C-D-end, a delay of each processing of A to D can be found by collecting time-stamped logs immediately before A, in the middle of A-B, in the middle of B-C, in the middle of C-D, and immediately after D. For example, in a case where B is delayed, the delay can be found using a log between A and B (immediately before B) and a log between B and C (immediately after B)=a log before and after B.
On the other hand, in order to find an abnormal point in an application program or a network component, it is necessary to collect a large number of logs at a plurality of monitoring points.
For this reason, narrowing and identifying an abnormal point would cause a considerable execution overhead and network load.
[Patent Document 1] Japanese Patent Publication No. 2011-211295
[Patent Document 2] Japanese Patent Publication No. 2006-222808
In such an application program or network component, processing using a common module is performed in a plurality of processings.
A delay of a particular module causes a delay in a plurality of relevant processings. An identification of a module being delayed may be performed by, for example, taking an average of a response time at regular time intervals, comparing the average time with a normal or abnormal threshold value, and classifying normally operating processing and delayed processing based on the comparison result.
However, depending on a method of taking a length, a timing, or the like of an interval during which processing time is averaged, appropriate data may not be obtained, for example, processing to be originally diagnosed as abnormal may be classified as normal processing, or information necessary for identifying a problem may not be obtained.